Re: Current qc_defer implementation may lead to infinite recursion

[Tejun Heo <htejun@gmail.com>]

Elias Oltmanns wrote:
> +static int piix_qc_defer(struct ata_queued_cmd *qc)
> +{
> +	static struct ata_port *ap = NULL;
> +	struct ata_queued_cmd qcmd[ATA_MAX_QUEUE];

missing static?

> +	static int count = 0;
> +#define PIIX_QC_DEFER_THRESHOLD 5000
> +
> +	if (!ap)
> +		ap = qc->ap;
> +	else if (ap != qc->ap)
> +		return 0;
> +
> +	if (count > PIIX_QC_DEFER_THRESHOLD + 100)
> +		return 0;
> +
> +	count++;
> +	if (count < PIIX_QC_DEFER_THRESHOLD)
> +		return 0;
> +	else if (count == PIIX_QC_DEFER_THRESHOLD) {
> +		int i;
> +		if (ap->qc_allocated) {
> +			for (i = 0; i < ATA_MAX_QUEUE; i++)
> +				qcmd[i] = ap->qcmd[i];
> +			printk(KERN_DEBUG "piix_qc_defer(): saved current state\n");
> +			msleep(5000);
> +		} else
> +			count--;
> +	} else if (count == PIIX_QC_DEFER_THRESHOLD + 100) {
> +		dump_stack();
> +		count++;
> +	} else if (memcmp(qcmd, ap->qcmd, sizeof(qcmd[0]) * ATA_MAX_QUEUE))

memcmp() will always mismatch.  qcmd contains garbage.

> +		return ATA_DEFER_LINK;
> +	else
> +		count = 0;
> +	return 0;
> +}
> +
>  static const struct piix_map_db ich5_map_db = {
>  	.mask = 0x7,
>  	.port_enable = 0x3,
> ---
> 
> 
> ====================================================================
> Feb 11 20:33:05 denkblock kernel: piix_qc_defer(): saved current state
> Feb 11 20:33:11 denkblock kernel: BUG: scheduling while atomic: swapper/0/0x00000100

You can't call msleep(5000) there.

Thanks.

-- 
tejun